Protocol practice· Federation & Identity Standards Members
JWT validation: five tokens, and which ones an API should accept
Objective: The notes API accepts JWT access tokens from login.lumen.example. Five tokens arrive in an afternoon. Four of them should be refused. Write the checks, in order, so only the real one gets through.
5 steps11 concepts 10 min
Where JWT validation fitsNot sure? Which protocol?
What may this app do? · 6 labs
- OAuth
- Token exchange
- Workload federation
- JWT validationYou are here
- Just-in-time admin
- Conditional Access
What you’ll do
- 1Token 1: the right issuer, the wrong kind of token. The first token is signed by your own authorization server and names the right user.
- 2Token 2: no signature at all. The second token says it uses the algorithm none, and has an empty signature.
- 3Token 3: signed with the wrong kind of key. The third token says HS256, a shared-secret algorithm.
- 4Token 4: a real token, for someone else. The fourth token is genuine: typed at+jwt, RS256, signed by your issuer with a key from its jwks_uri.
- 5Token 5: the real one, and the clock. The fifth token passes everything so far: at+jwt, RS256, your issuer, your API, a good signature.